Overview
Aug 2613,277
Jul 2618,442
Jun 2622,732
May 267,405
Apr 2616,732
Mar 2620,981
Feb 2640,387
Jan 268,919
Dec 2511,740
Nov 2512,563
Oct 258,835
Sep 257,297
Aug 253,782
Jul 25700
Jun 253
January 2026 Intelligence Report
24%
8,919
4,808
Taken Down
3,178
Still Live
53.9%
Kill Rate
1906h
Avg Response
9.8
Avg VT Score
In January 2026, PhishDestroy detected 8,919 phishing domains, a 24% decrease from December. 4,657 of them (52.2%) have already been neutralized, while 3,459 remain live and under active escalation. The most abused registrar was NiceNIC International Group Co., Limited with 1,316 malicious domains, followed by PDR Ltd. d/b/a PublicDomainRegistry.com (972). Attackers targeted genericcrypto hardest, with x.com a close second.
- NiceNIC International Group Co., Limited alone accounts for 14.8% of the month's detections (1,316 domains) — concentration this high indicates systematic abuse, not random sign-ups.
- Brand pressure is concentrated on genericcrypto and x.com — 1,429 lookalike domains between them.
- The .com TLD leads with 3,244 malicious registrations, ahead of .cc (685).
- Dominant drainer kit: Solana Drainer (254 deployments detected).
- Average infrastructure response time: 1906h — well beyond any reasonable takedown window.
Outlook
Heading into February 2026, expect continued pressure on genericcrypto users; registrations via NiceNIC International Group Co., Limited remain the primary vector to watch, with Solana Drainer kits still circulating. Full evidence for every domain is published in the public destroylist.
Top Registrars
| Registrar | Domains |
|---|---|
| NiceNIC International Group Co., Limited | 1,316 |
| PDR Ltd. d/b/a PublicDomainRegistry.com | 972 |
| Gname.com Pte. Ltd. | 779 |
| Dynadot LLC | 453 |
| Web Commerce Communications Limited | 442 |
| NameSilo, LLC | 436 |
| NameCheap, Inc. | 436 |
| GoDaddy.com, LLC | 339 |
Targeted Brands
| Brand | Domains |
|---|---|
| genericcrypto | 913 |
| x.com | 516 |
| argent | 461 |
| across | 400 |
| binance | 291 |
| 261 | |
| base | 259 |
| cryptoscam | 226 |
Active Drainer Kits
January 2026 Domains (8,919)
Sorted by VirusTotal detections. Click any domain for full security report.
Detection Trends
Monthly domain volume, kill rate, and live threats over time.
Monthly Detected Domains
Kill Rate %
Explore More
Related intelligence pages and data feeds.